npx @wardix/cli@0.2.3 · one step in CI

See your app the way attackers do.

The shipped bundle is the real attack surface. Wardix reads Android APKs and developer-exported iOS IPAs straight from the pipeline.

Request account→ Read the alpha guide

No agent, no SDK, no source upload — the binary is deleted when the scan ends.

release.yml — wardix gate live

3 new·1 fixed·41 persisting exit 1 only when this build introduced new findings at or above your threshold exit 1

findings anchored to OWASP MASVS MASTG CWE SARIF 2.1 — the standards your auditors already read

01 · Why the bundle

Attackers don't read your repo. They read your release.

The shipped artifact is rarely analyzed

Multiple teams merge into one bundle. What actually ships — after bundling, codegen and config injection — is the thing nobody inspects.

Pentests are snapshots; you ship weekly

An audit once a year describes a build from months ago. Every release between audits ships on trust.

Extraction is automated now

A leaked key was never worth six hours of manual reverse engineering. Automated across ten thousand store apps, it is.

02 · The release gate

One verdict, where the release decision already happens.

No new dashboard to babysit. The scan passes or fails the pipeline at the severity threshold you set.

pass no new findings at or above your threshold exit 0

fail new findings at or above your threshold exit 1

Findings below your threshold stay visible without blocking. Dismissals carry forward and export to GitHub code scanning as suppressions.

# .github/workflows/security.yml
- uses: wardixio/wardix-scan-action@v1
  with:
    artifact: build/app-release.apk
    key: ${{ secrets.WARDIX_KEY }}
    fail-on: critical

Android APK and developer-exported iOS IPA

Attackers automate. So should you.

Connect one app and your next build becomes the baseline. Every release after it gets a diff and a verdict.

Request account→ Read the alpha guide

invitation-only alpha · first scan becomes the baseline · wardix.io